What an AI agent actually does, and what it still cannot do

“AI agent” now gets attached to everything from chatbots with a calendar button to software that can work through a coding task for an afternoon. Strip away the branding and the useful difference is smaller: an agent can choose a next step, use an allowed tool, inspect what happened and try again.

The short answer

An AI agent is a model operating inside a loop. It receives a goal, chooses from the tools it has been given, reads the result and decides what to do next. The run ends when it produces an answer, reaches a stopping condition or pauses for a person.

An agent is a permissioned loop, not a digital employee.

A chatbot can explain how to sort a crowded inbox. An agent with email access might search that inbox, group messages and draft replies. That does not mean it understands every relationship, knows which message is secretly urgent or deserves permission to press Send. Its reach comes from the tools and authority people give it. Its mistakes can reach that far, too.

The model is one component. The loop, tools, permissions and stopping rules are what make the system agentic.

What happens inside the loop

1. A goal or trigger starts the run. That may be a direct request, a scheduled time or an event in another system.
2. The model interprets the next useful step. It can answer immediately or request one of the tools exposed by the surrounding application.
3. The application executes the tool. The model is not secretly operating a computer. Software around it checks the request, applies permissions and performs the action.
4. The result comes back into context. The model reads what happened, updates its plan and chooses again.
5. The run stops, escalates or hands off. Good systems define limits instead of letting the loop wander forever.

Definitions vary across the industry. Anthropic distinguishes fixed, predefined workflows from agents that dynamically direct their own tool use. OpenAI describes the core as a model equipped with instructions and tools that runs in a loop. Those descriptions use different language, but the practical architecture is similar.

A concrete example

Imagine a weekly product-update brief. Every Friday morning, an agent checks a fixed list of official changelogs and RSS feeds. It compares the newest entries with last week’s issue, drafts short summaries, attaches the source links and flags anything ambiguous. Then it stops.

The editor still decides whether a small feature matters to readers, whether a vendor’s claim needs independent confirmation and whether the brief deserves publication. The agent handled repeatable collection and comparison. It did not inherit editorial judgment.

Agent, chatbot or ordinary automation?

The hybrid is often the sensible version. Let a model handle the ambiguous middle, while ordinary code controls access, spending limits, irreversible actions and publication.

What agents are genuinely useful for

Agents fit work that is repeatable, tool-based and easy to inspect. Useful examples include sorting and routing requests, extracting structured fields, assembling research briefs with citations, drafting from approved sources, opening tickets and proposing code changes that arrive with tests and a visible diff.

They are less compelling when one careful answer will do. Agent loops add time, cost and more opportunities for error. Anthropic’s guidance is blunt on this point: start with the simplest approach that works and add agentic complexity only when it produces a real improvement.

What an agent still cannot do reliably

• Guarantee truth. Tool access can improve evidence, but a model can still produce a plausible false conclusion. NIST calls this risk confabulation.
• See beyond its connections. No tool or permission means no access. A polished answer does not prove that the system checked the account, file or database you had in mind.
• Remember everything forever. Context is finite. Long-running systems need deliberate memory, summaries and state management.
• Resolve vague goals without guessing. If success is undefined, the agent has to fill in the blanks. That is dangerous when the action is expensive or hard to reverse.
• Ignore hostile instructions automatically. Webpages, emails and documents can contain prompt injections designed to redirect an agent or expose data. Current safety work focuses on constraining the damage even if manipulation succeeds.
• Improve itself by magic. Reliable improvement requires traces, feedback, evaluations, reviewed changes and a decision to deploy them.
• Replace accountability. A confident output does not transfer responsibility away from the person or company operating the system.

The five-question agent reality check

When a product calls itself an agent, ask these questions:

1. What starts it? A person, an event or a schedule?
2. What outcome can be measured? “Be helpful” is not a usable finish line.
3. Which exact tools and data can it reach? Look for names, not vague claims about integrations.
4. Which actions are reversible, capped or approval-gated? Drafting is not the same risk as sending.
5. What makes it stop, escalate and leave a record? A useful agent should make intervention and review easy.

If a company cannot answer those questions, “agent” is mostly a label.

How much autonomy should you give one?

Start with actions that are easy to inspect and undo: read, summarize, classify and draft. Move next to reversible record changes, ticket creation or unpublished content. Treat sending messages, publishing, deleting, spending money, changing permissions and exposing private data as a different risk class.

More autonomy should follow observed performance on the real task, not a dramatic demo. Preserve logs. Test failure cases. Keep a clear intervention path. Add authority in small pieces.

The bottom line

An agent is useful because it can keep working through a bounded problem. It does not gain human judgment just because its chat sounds natural. Judge an agent by its tools, evidence, permissions, controls and stopping conditions. Those details tell you far more than the label.